As you can see, it only creates 5 fields automatically - “facility” , “level” , “message” , “source” , “timestamp”
I would like to split the “message” field into:
etc etc etc for all the fields.
I understand I need to use extractors to do this, but cant for the life of me work out how to use REGEX / GROK etc (whatever I should be using) to do this.
If I just use a whitespace character, fields like “msg” and “time” don’t get split properly, because they contatin a space…
So I thought I’d ask the wonderful community!
Can anyone explain how to go about splitting this into multiple sections?
Of course we can do it. But I think better if you learn and understand it.
Find a good regex summary. Read it. Read again. Find an online regexp tester, and try it.
You Will be better if you take Time, and learn.
//I’m not sure you can copy multiple fields with regex extractor. Grok can do it.
I agree 100%, if this was something I needed to do commonly, or even if my job required any knowledge of regex/grok beyond this specific task, then absolutely I would learn from scratch - it’s quite interesting.
Unfortunately, I’m spread thin, and simply do not have the time to devote to researching this much more than i already have at the moment.
I have one firewall which spits this out - I can currently search using "message:searchterm " but the proceeding wildcard makes it a resource heavy operation.
But then when I attempt to use this in Graylog in “replace with regular expression” extractor on field “message”, using:
replacement of $1 - it gives each of the first groups from the regex ( id sn time fw pri c m msg n src dst srcMac dstMac proto fw_action)
replacement of $2 - it gives each of the second groups (SonicWallApollo 000000000000 “2019-01-11 18:01:59” 18.104.22.168 4 32 866 “Possible SYN Flood on IF X0 - src: 22.214.171.124:6172 dst: 126.96.36.199:6746 - rate: 375/sec continues” etc etc)
replacement of $1=$2 just gives me the full message as normal.
I feel like I’m getting close but I’m obviously missing something about how to split each of these out into separate fields - any tips?